Portable executable file format (PE file format), as defined by Microsoft Corporation in the “Microsoft Portable Executable and Common Object File Format Specification” is a file format for executables, object code and DLL's (dynamic link libraries). PE files are used in 32-bit and 64-bit versions of the Microsoft Windows operating systems. The PE file format is a highly versatile format that can be used in numerous operating system environments and supports various processor solutions.
Software developers may use various schemes to protect software, including PE files. For example, software packers may be utilized to compress binaries, which may decrease bandwidth usage associated with transferring the binaries and storage volume. Similarly, packers may be utilized to protect intellectual property embodied within the software and to prevent code theft. Packing may involve various schemes of compression and/or encryption that may obfuscate the contents of the executable code. Running the packed executable file may unpack the original executable code (e.g., which may include decompressing and/or decrypting) and then transferring control to the original executable code. As such, the nature of the executable code may not be known until the software is actually executing. This can be problematic, for example, if the executable code is malware or other undesirable software, as the nature of the software may not be known until it is too late.